joblib

joblib

Python Package Index

Releases105

Frequency1 month 4 weeks

Last Release7 months ago

Lightweight pipelining with Python functions

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2024-34997NVD↗	= 1.4.2	May 17, 2024Friday, 17 May 2024, 19:15	7.5 HIGH	—
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
CVE-2022-21797NVD↗	= *, < 1.1.1	Sep 26, 2022Monday, 26 September 2022, 05:15	7.3 HIGH	—
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.